A flaw exists in the Online Hotel Management System that allows an attacker to insert arbitrary script code into the Name field of the POST request sent to /admin/mod_room/controller.php?action=add. The unsanitized input is reflected back to browsers under the context of that page, enabling attackers to run malicious scripts in the victim’s session, potentially stealing credentials, defacing content or performing other client‑side attacks. The weakness is classified as CWE‑79 and, due to the possibility of arbitrary code execution within the system’s context, also tagged CWE‑94.

The vulnerability affects version 1.0 of itsourcecode Online Hotel Management System. The affected component is the POST Request Handler located in controller.php within the admin/mod_room directory, accessed through action=add.

The CVSS score of 5.3 indicates a moderate risk. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack can be launched remotely from an unauthenticated or authenticated user with access to the admin interface. Publicly available exploits demonstrate the feasibility of injecting malicious payloads and achieving client‑side compromise.